What is claimed is: 



1. A method for selectively shadowing only accesses to external storage media connected to 
a computer, the method comprising: 

detecting a data access to an external storage medium; and 

writing a copy of the accessed data to a storage location other than the external storage 
medium; 

2. The method of claim 1 wherein the access is a write operation. 

3. The method of claim 1 wherein the access is a read operation. 

4. The method of claim 1 wherein the detecting step comprises: 

intercepting an I/O request from the computer to an external storage media drive in 
which the external storage media is inserted. 

5. The method of claim 4 wherein the I/O request is one of the group consisting of a file open 
or creation request, a write request, a file close request, a file system control request and a 
read request. 

6. The method of claim 5 further comprising: 

providing a proxy handler for the I/O request; and 
executing the proxy handler, in response to the detecting step. 

7. The method of claim 4 wherein the computer runs under a Windows operating system and 
the I/O request is one of the group consisting of IRP_MJ_CREATE, IRP_MJ_WRITE, 
IRP_MJ_CLOSE, IRP_MJ_FILE_SYSTEM_CONTROL and IRP_MJ_READ packets. 
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1 8. The method of claim 7 further comprising: 

2 providing proxy handlers for the IRPJVLT_CREATE, IRP_MJ_WRTTE, 

3 IRP__MJ_CLOSE and IRP„MJ_FILE_SYSTEM_CONTROL packets; and 

4 executing one of the proxy handlers, in response to the detecting step when the I/O 

5 request is a respective packet selected from the group consisting of IRP_MJ_CREATE, 

6 IRP__MJ_WRITE, IRP_MJ_CLOSE and IRP_MJ_FTLE_S YSTEM_CONTROL packets. 
7 

8 9. The method of claim 8 further comprising: 

9 providing a proxy handlers for the IRP_MJ_READ packet; and 

10 executing the proxy handlers for the IRP_MJ_READ packet, in response to the 

1 1 detecting step when the I/O request is an IRP_MJ_READ packet. 
12 

13 10. The method of claim 1 wherein the storage location other than the external storage media 

14 is a protected storage location. 

15 

16 11. The method of claim 1 further comprising: 

17 writing the data to the external storage medium after the step of writing a copy of the 

18 data to a storage location other than the external storage medium. 
19 

20 12. The method of claim 1 further comprising: 

21 attaching to one or more file systems connected to an external storage media drive in 

22 which the external storage medium is inserted; and 

23 wherein the detecting step comprises intercepting I/O requests to the one or more file 

24 systems. 
25 

26 13. The method of claim 1 wherein the external storage medium is selected from the group 

27 consisting of a floppy disk; a CD, a removable hard disk drive, and a zip disk drive. 

28 
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1 14. The method of claim 1 further comprising: 

2 collecting the copy into a database where similar copies are collected; and 

3 querying the database, 
4 

5 15. The method of claim 14 wherein the database comprises records, each record comprising 

6 the copied data, a file name associated with the data, an identification of who initiated the 

7 data access, a station ID, and when the access was made. 
8 

9 16. The method of claim 14 wherein the computer is connected to a computer network, and 

10 the detecting and copying steps are performed at the computer, and the collecting and 

1 1 querying steps are performed at another computer on the network. 
12 

13 17. The method of claim 14 wherein the collecting and querying steps are performed by a 

14 user with administrator privileges. 
15 

16 18. A computer readable medium on which is embedded computer software, the software 

17 performing a method, the method comprising: 

18 detecting a data access to an external storage medium; and 

19 writing a copy of the accessed data to a storage location other than the external storage 

20 medium; 

21 

22 19. The computer readable medium of claim 18 wherein the access is a write operation. 

23 

24 20. The computer readable medium of claim 18 wherein the detecting step comprises: 

25 intercepting an I/O request from the computer to an external storage media drive in 

26 which the external storage media is inserted. 
27 

28 
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1 21. The computer readable medium of claim 20 wherein the computer system runs under a 

2 Windows operating system and the I/O request is one of the group consisting of 

3 IRP_MJ_CREATE, IRP_MJ_WRITE, IRP„MJ_CLOSE, 

4 IRP_MJ_FILE_SYSTEM_CONTROL and DRP_MJ_READ packets. 

5 

6 22. An apparatus for selectively shadowing only accesses to external storage media 

7 connected to a computer, the apparatus comprising: 

8 a detector that receives I/O requests to an external storage medium; and 

9 a storage, other than the external storage medium, connected to the detector, in which 
10 a copy of the accessed data is written. 

11 

12 23. The apparatus of claim 22 further comprising 

13 one or more proxy handlers connected to the detector, wherein the proxy handlers 

14 handle certain I/O requests. 
15 

16 24. The apparatus of claim 23 wherein the certain I/O requests comprise IRP_MJ_CREATE, 

17 IRP„MJ_WRrTE, IRP_MJ_CLOSE and IRP„MJ_FELE_SYSTEM_CONTROL packet. 
18 

19 25. The apparatus of claim 24 wherein the certain I/O requests further comprise an 

20 IRP_MJ_READ packet. 
21 

22 26. The apparatus of claim 23 further comprising: 

23 a list, connected to at least some of the one or more proxy handlers, in which file 

24 identifiers are contained. 

25 

26 27. The apparatus of claim 26 wherein the file identifiers are IRRFsContext values. 

27 
28 
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1 28. The apparatus of claim 23 further comprising: 

2 one or more counters, connected to at least some of the one or more proxy handlers, 

3 by which certain file operations are counted. 

4 

5 29. The apparatus of claim 23 wherein the computer runs under a Windows operating 

6 system, and the one or more proxy handlers are connected to I/O request packet drivers 

7 supplied by the operating system. 

8 

9 30. The apparatus of claim 23 wherein the Windows operating system is selected form the 

10 group consisting of Windows NT and Windows 2000. 
ll 
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